[PATCH] tools/xenstore: domain can sometimes disappear when destroying connection

From: Petre Eftime <epetre@amazon.com>
To: xen-devel@lists.xenproject.org
Cc: Ian Jackson <ian.jackson@eu.citrix.com>,
	Wei Liu <wei.liu2@citrix.com>, Amit Shah <aams@amazon.com>,
	Petre Eftime <epetre@amazon.com>,
	David Woodhouse <dwmw@amazon.com>
Subject: [PATCH] tools/xenstore: domain can sometimes disappear when destroying connection
Date: Mon, 26 Nov 2018 13:22:04 +0000	[thread overview]
Message-ID: <20181126132204.16258-1-epetre@amazon.com> (raw)

There is a circular link formed between domain and a connection. In certain
circustances, when conn is freed, domain is also freed, which leads to use
after free when trying to set the conn field in domain to null.

Signed-off-by: Petre Eftime <epetre@amazon.com>
---
 tools/xenstore/xenstored_domain.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index fa6655033a..f085d40476 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -222,6 +222,7 @@ static void domain_cleanup(void)
 {
 	xc_dominfo_t dominfo;
 	struct domain *domain;
+	struct connection *tmp_conn;
 	int notify = 0;
 
  again:
@@ -238,8 +239,14 @@ static void domain_cleanup(void)
 				continue;
 		}
 		if (domain->conn) {
-			talloc_unlink(talloc_autofree_context(), domain->conn);
+			/*
+			 * In certain circumstances conn owns domain and
+			 * domain will be freed when conn is unlinked.
+			 */
+			tmp_conn = domain->conn;
 			domain->conn = NULL;
+
+			talloc_unlink(talloc_autofree_context(), tmp_conn);
 			notify = 0; /* destroy_domain() fires the watch */
 			goto again;
 		}
-- 
2.16.5




Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
